Skip to content

added PodSecurityContext #2174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

added PodSecurityContext #2174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a3f6e06
added PodSecurityContext
Sanket-0510 Feb 20, 2024
195733f
restored create cmd
Sanket-0510 Feb 20, 2024
2091749
added the struct
Sanket-0510 Feb 20, 2024
f56dce1
Merge branch 'knative:main' into PodSecurityContext
Sanket-0510 Apr 29, 2025
98a79ad
some fixes realted formating and description
Sanket-0510 Apr 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions pkg/functions/function.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,8 @@ type RunSpec struct {
// Env variables to be set
Envs Envs `yaml:"envs,omitempty"`

// PodSecurityContext to be set for read and write permission
PodSecurityContext PodSecurityContext `yaml:"podSecurityContext, omitempty"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can remove the extraneous space prepended to "omitempty" here

// StartTimeout specifies that this function should have a custom timeout
// when starting. This setting is currently respected by the host runner,
// with containerized docker runner and deployed Knative service integration
Expand Down
8 changes: 8 additions & 0 deletions pkg/functions/function_security.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
package functions

type PodSecurityContext struct {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should confirm with the Serving team, but this may need to be renamed SecurityContext and set at the Container level in the Knative Deployer in order to clear up the validation webhook error.

RunAsUser *int64 `yaml:"RunAsUser,omitempty"`
RunAsGroup *int64 `yaml:"RunAsGroup,omitempty"`
RunAsNonRoot *bool `yaml:"RunAsNonRoot,omitempty"`
FSGroup *int64 `yaml:"FSGroup,omitempty"`
}
13 changes: 12 additions & 1 deletion pkg/knative/deployer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,7 +461,7 @@ func generateNewService(f fn.Function, decorator DeployDecorator, daprInstalled
for k, v := range annotations {
revisionAnnotations[k] = v
}

PodSecurityContext := getPodSecurityContext(f.Run)
service := &v1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: f.Name,
Expand All @@ -477,6 +477,7 @@ func generateNewService(f fn.Function, decorator DeployDecorator, daprInstalled
},
Spec: v1.RevisionSpec{
PodSpec: corev1.PodSpec{
SecurityContext: PodSecurityContext,
Containers: []corev1.Container{
container,
},
Expand Down Expand Up @@ -1108,3 +1109,13 @@ func setServiceOptions(template *v1.RevisionTemplateSpec, options fn.Options) er

return servingclientlib.UpdateRevisionTemplateAnnotations(template, toUpdate, toRemove)
}

func getPodSecurityContext(RunSpec fn.RunSpec) *corev1.PodSecurityContext {
return &corev1.PodSecurityContext{
RunAsUser: RunSpec.PodSecurityContext.RunAsUser,
RunAsGroup: RunSpec.PodSecurityContext.RunAsGroup,
RunAsNonRoot: RunSpec.PodSecurityContext.RunAsNonRoot,
FSGroup: RunSpec.PodSecurityContext.FSGroup,
}

}
20 changes: 20 additions & 0 deletions schema/func_yaml-schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -386,6 +386,26 @@
"type": "array",
"description": "Env variables to be set"
},
"podSecurityContext": {
"properties": {
"RunAsUser": {
"pattern": "^[-._a-zA-Z][-._a-zA-Z0-9]*$",
"type": "integer"
},
"RunAsGroup": {
"type": "integer"
},
"RunAsNonRoot":{
"type": "boolean"
},
"FSGroup":{
"type":"integer"
}
},
"additionalProperties": false,
"type": "object"

Check failure on line 407 in schema/func_yaml-schema.json

View workflow job for this annotation

GitHub Actions / style / Golang / Lint 

[trailing whitespace] reported by reviewdog 🐶
                    

Raw Output:
schema/func_yaml-schema.json:407:
},
"startTimeout": {
"type": "integer",
"description": "StartTimeout specifies that this function should have a custom timeout\nwhen starting. This setting is currently respected by the host runner,\nwith containerized docker runner and deployed Knative service integration\nin development."
Expand Down
Loading